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We realize an end-to-end no-switching quantum key distribution protocol using continuous-wave coherent 
light. We encode weak broadband Gaussian modulations onto the amplitude and phase quadratures of light 
beams. Our no-switching protocol achieves high secret key rate via a post-selection protocol that utilizes both 
quadrature information simultaneously. We establish a secret key rate of 25 Mbits/s for a lossless channel and 
1 kbit/s for 90% channel loss, per 17 MHz of detected bandwidth, assuming individual Gaussian eavesdropping 
attacks. Since our scheme is truly broadband, it can potentially deliver orders of magnitude higher key rates by 
extending the encoding bandwidth with higher-end telecommunication technology. 



Quantum key distribution (QKD) 1 1 ] is a technique for gen- 
erating a shared cryptographic key between two parties, Al- 
ice and Bob, where the security of the shared key is guaran- 
teed by the laws of quantum mechanics. QKD based on con- 
tinuous variables (CV) 01, in particular coherent state QKD 
iilS-ElllllIlEi' promises significantly higher secret key rates 
in comparison to single photon schemes ll|,|3|]. They are rela- 
tively simple to implement, in contrast to QKD protocols em- 
ploying "non-classical" states fioll . Coherent states are read- 
ily produced by a stabilized laser and can be detected using 
high quantum efficiency detectors. Confidence in the practi- 
cability of coherent state QKD protocols has increased since it 
was shown that the security of these protocols can be ensured 
for channel losses greater than 50% using post-selection 01 
or reverse reconciliation 0] procedures. In principle, it is 
therefore possible to generate a secure key even in the pres- 
ence of arbitrarily high loss. This development, coupled with 
potentially high secret key rates, render coherent state QKD 
protocols viable contenders for real-world cryptographic ap- 
plications. 

Our coherent state QKD protocol builds on previous proto- 
cols presented in |5j,|6j,|7|] and is an advance on random switch- 
ing by simultaneously measuring both measurement bases 0] ■ 
The QKD protocol operates as follows. Alice draws two ran- 
dom numbers xa and pa from two Gaussian probability dis- 
tributions with zero mean and variances of V(xa) and V(pa) 
respectively. Alice prepares a coherent state \xa + ipa) and 
sends it to Bob. As a result of losses in the quantum channel, 
vacuum noise is coupled into the transmitted state. On receiv- 
ing the state, Bob simultaneously measures both the amplitude 
(xb) and phase (ps) quadratures of the state via a 50/50 beam 
splitter. At this stage, Alice and Bob share correlated random 
data from which they can generate a secret key. They use post- 
selection |a] to reverse any initial "information advantage" a 
potential eavesdropper (Eve) might have obtained, and per- 
form information reconciliation and privacy amplification to 
distill a final secret key. Although no-switching coherent state 
QKD protocols have been demonstrated to be secure against 
coherent (collective) attacks 1 1 1 ] and progress has been made 
towards proving the unconditional security of CV coherent 
state QKD protocols , we restrict our analysis of Eve 



here to only incoherent Gaussian attack [4-9]. 




FIG. 1: Schematic of experiment. LO: local oscillator; RNG: random 
number generators; AM/PM: amplitude/phase modulators; PBS: po- 
larizing beam splitter; A/2: half wave plate; BS: 50/50 beam splitter; 
0): vacuum state, (inset) (i) Bob's detected noise spectra of the 
broadband modulation encoding shown with respect to the quantum 
noise limit (ii). Grey region denotes the 17 MHz sideband frequency 
spectrum used in our analysis. 

The experimental set-up is shown in Fig. [J In our imple- 
mentation we use a continuous-wave, coherent laser operat- 
ing at 1064 nm. In contrast to pulsed or temporal encoding 
schemes, we achieve high secret key rates by exploiting the 
continuous-wave nature of the laser field to implement a true 
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broadband encoding protocol. We employ standard electro- 
optic modulators to encode weak broadband modulations onto 
the quantum states at the sideband frequencies of the electro- 
magnetic field. Using this technique, the transmission rate of 
coherent states can be arbitrarily increased, limited only by 
Alice's encoding and Bob's detection bandwidths. To max- 
imize Bob's detection bandwidth, we simultaneously mea- 
sure both the amplitude and phase quadratures of the electro- 
magnetic field at Bob's station, using the no-switching proto- 
col 1 8]. This protocol has a significantly improved secret key 
rate and no weakening of security when compared with pre- 
vious protocols that rely on random switching between mea- 
surement bases. This random switching requires the precise 
and rapid control of the optical phase of a local oscillator field, 
which is difficult to achieve in practice. 

In the experiment we process quantum states encoded on 
17 MHz of the sideband frequency spectrum (Fig. ^ (inset)). 
As intrinsic classical noise is manifest at low frequencies on 
the laser beam and our data acquisition system has a maxi- 
mum sample rate of 50 MHz, we process data from side-band 
frequencies between 33 MHz and 50 MHz. We verify that the 
laser field is coherent in this range with both quadrature vari- 
ances equal to V(x), V(p) = 1.01 ± 0.01, normalized to the 
quantum noise limit. We digitally filter the data in the identi- 
fied frequency band, demodulate and re-sample it at 17 MHz. 
To improve the statistical correlations between Alice's and 
Bob's data, we apply a previously characterized transfer func- 
tion to the data, which corrects for the frequency response of 
Alice's electro-optic modulator and Bob's detectors. After 
this data processing, Alice and Bob have correlated random 
data with Gaussian probability distributions which are shown 
in a scatter-plot diagram (Fig.|2ja)). Using a random subset of 
this data they can quantify the quantum channel transmission 
efficiencies of each quadrature (r] x and r] p ), and the variances 
of Alice's quadrature displacements (V(xa) and V^^)) and 
thereby verify that the channel noise introduced as a result of 
transmission losses corresponds to a vacuum state. Although 
here we assume Gaussian attacks, Alice and Bob can check for 
non-Gaussian attacks by analyzing, prior to post-selection, the 
statistical distribution of the announced set of data. Finally, 
Alice and Bob can determine the maximum information Eve 
could have obtained during quantum state transmission. 

In our security analysis, we assume that Eve performs a 
beam splitter attack where she replaces the quantum chan- 
nel with a perfect lossless line and uses a beam splitter to 
simulate the channel transmission losses. The security of our 
protocol relies on the indistinguishability of non-orthogonal 
pure states flill . For every transmitted state, Alice publicly 
announces the absolute values \xa\ and \pa\, thereby requir- 
ing Bob (and Eve) to distinguish from one of the four possi- 
ble coherent states prepared by Alice | ± xa ± ipa)- So that 
Eve's state after the beam splitting attack can be expressed 
as | ± yJl — r]XA ± W^ — iiPa)- The general solution for the 
maximum Shannon information for the indistinguishability of 
four pure states is not known. To calculate Eve's Shannon in- 
formation, we assume that after the beam spitter attack Eve 
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FIG. 2: (a) The "global" perspective of Alice's (xa) and Bob's (xb) 
data, represented in a scatter-plot diagram, for transmission losses of 
54%. Dotted lines: "banded information channels"; Green points: 
data that has error free binary encoding; Blue points: data that has 
bit-flip errors; Red points: data that has a negative net information 
rate, (b) Bob's perspective of his and Alice's data, (c) The global 
perspective and (d) Bob's perspective of the theoretical net informa- 
tion rate contour plots. 



splits her state on a 50/50 beam splitter, which corresponds to 
an optimal cloning of the information on the two quadratures, 
and performs Helstrom measurements denoted H x and 
H p , on the two resulting outputs. For each Helstrom measure- 
ment, H x or Hp, Eve must distinguish between two mixed 
states, each being a mixture of two pure states on either side 
of the x,p — axis. The Shannon information for the distin- 
guishability of two pure states of an equivalent separation is 
greater than for that of two mixed states f? ], hence giving us 
an upper bound on Eve's information 1 15] 



Iae = E v = {XlP} [Kl+VI^logaCl+V^) (1) 

+i(i-VT^!)iog 2 (i-yr^)" 

where z v = \(-v E \v E )\ 2 = e" 2 ^! 2 = e^ 1 ^^! 2 are 
Eve's quadrature overlap functions, and v = {x,p}. 

We next calculate the mutual information between Alice 
and Bob. The scatter-plot diagram of Fig. |2ja) and (b) show 
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the "global" perspective of Alice's and Bob's results, and 
Bob's perspective during the QKD protocol (after Alice pub- 
licly announces the absolute value of her data) respectively. 
To interpret information encoded onto the quantum states, Al- 
ice and Bob use a binary encoding system based on the direc- 
tional displacements of the quadrature measurements, inter- 
preting positive displacements in phase space as a binary "1" 
and negative displacements as a binary "0". Hence two bits of 
information are encoded per transmitted state (one bit on each 
quadrature). From the global perspective of Alice's and Bob's 
results (Fig. |3 a)), the points in the diagonal quadrants corre- 
spond to error-free bits, whilst the points in the off-diagonal 
quadrants correspond to bit-flip errors. We encode at approx- 
imately the Shannon capacity of the quantum channel 1 16] by 
partitioning Alice's and Bob's data into "banded information 
channels" (BICs). We achieve this by calculating the theoret- 
ical probability of error for Alice's and Bob's data given by 



(2) 



and allocate the data into BICs with increasing probabilities of 
error, as shown by the dotted hyperbolas in Fig.|2ja) and[2b). 
For each BIC, let the number of error-free points be denoted 
by -/Vgood and the number of bit-flip errors by iVerror- We cal- 
culate the experimental probability of error for each BIC us- 
ing P v = N clrol / (N mor + Ngood) ■ Bob's mutual information 
with Alice summed over n BICs is given by 

lAB = T, v ={ x ,p} ELi ]} + p (v,k)log 2 (P{ v ,k)) (3) 

+ (1 - P( w ,fe))l0g 2 (l - P(v,k)) 

where Pt v ,k) is the probability error rate for the kth BIC, of 
either the amplitude or phase quadrature. The mutual infor- 
mation rate between Alice and Bob (Eq. 0) approaches the 
Shannon capacity 11611 as the number of BICs is increased. In 
our analysis we partition the data into 10 BICs by assigning an 
equal number of data points to each, thereby achieving a mu- 
tual information rate , prior to information reconciliation and 
privacy amplification, of ~ 99% of the Shannon information 
limit for a binary symmetric quantum channel (Fig.[3](inset)). 

From his perspective Bob can calculate, for each BIC, the 
amount of mutual information he has with Alice (Eq. 0), and 
Eve has with Alice (Eq. Q). The total secret information rate 
summed over all BICs can be expressed as 



AI = 



E EG 

v—{x,p} k=l 



AB(v,k) 



~ J J lAEP(vA,V B )dv A dvB 



(4) 

where the joint probability distribution of Alice and Bob's 
measurements is given by P(va,Vb), is the area of 

the fcth BIC of either the amplitude or phase quadrature, and 
Bob's mutual information with Alice for the fcth BIC for each 
quadrature is denoted by I A B(v,k)- Figure Etc) is a contour 
plot of the theoretical net information rate from a "global" per- 
spective of Alice's and Bob's results. Alice and Bob cannot 



directly use Fig.|2jc), as Bob only knows the absolute values 
of Alice's data. Bob's perspective of the theoretical net in- 
formation rate is shown in Fig.[2Jd). Using Eq. 10} Bob can 
post-select points about which his mutual information with 
Alice is greater than Eve's maximum accessible information. 
Applying this post-selection procedure Alice and Bob gain an 
"information advantage" over Eve, reversing Eve's possible 
information advantage prior to post-selection |6]. 
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FIG. 3: Secret key rate for varying channel losses. Solid line: the- 
oretical net Shannon information rate; Circle symbols: experimental 
secret key rate after post-selection; Square symbols: secret key rate 
after privacy amplification, (inset) Bob's mutual information with 
Alice (normalized to the Shannon's capacity) for increasing number 
of banded information channels with 54% channel loss. 



After post-selection, we proceed to distill an errorless secret 
key by performing an information reconciliation procedure. 
We take advantage of the BICs, each having differing proba- 
bility error rates, by applying the reconciliation procedure iter- 
atively to each BIC, thereby increasing the overall efficiency 
of the procedure. To amplify Bob's information advantage, 
we apply an "n-bit repeat code" advantage distillation proto- 
col o, at the cost of reducing the size of the key. After ad- 
vantage distillation, we apply the well known "Cascade" error 
reconciliation protocol 1 181 to correct the remaining errors. 
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90% Transmission Loss 


54% Transmission Loss 


Rate (bits/s) 


P Bob (%) 


P Eve (%) 


AI (bits/sym) 


Rate (bits/s) 


P Bob (%) 


P Eve (%) 


AJ (bits/sym) 


Raw Data 


3 x 10 7 


40 


24 


-0.18 


3 x 10 7 


19 


16 


-0.07 


Post-Selection 


6 x 10 4 


29 


30 


0.01 


1 x 10 7 


13 


17 


0.10 


Advantage Distillation 


9 x 10 3 


10 


21 


0.27 


5 x 10 6 


5 


10 


0.18 


Information Reconciliation 


9 x 10 3 


~0 


8 


0.40 


5 x 10 6 


~0 


4 


0.24 


Privacy Amplification 


1 x 10 3 


~0 


~50 


1.00 


4 x 10 5 


~0 


-50 


1.00 



TABLE I: Experimental results for the different stages of the QKD protocol. Each procedural step shows Bob's and Eve's probability error 
rates (P), the corresponding net information rate (AI bits/symbol) and the final secret key rate (bits/second). Eve's total information about the 
final secret key is less than one bit. 



We distill a final secret key by employing a privacy amplifi- 
cation procedure based on universal hashing functions 11911 . 
Eve's resulting information about the final secret key for each 
BIC is 2~ s /ln2 bits, where s is a security factor. We decrease 
Eve's total information about the final secret key (summed 
over all BICs and both quadratures) to less than one bit by 
discarding an additional s = 5 bits per BIC. 

Table 1 shows the experimental results for the processes 
used to distill a final secret key. For 90% channel loss, Eve's 
probability error rate in the raw data is lower than Bob's er- 
ror rate with a corresponding negative information rate of 
AI = —0.18 bits/symbol. Using post-selection Alice and 
Bob get a slight information advantage over Eve {AI = 0.01 
bits/symbol), which is further enhanced through advantage 
distillation. The cost of these processes is a reduction in the 
size of the secret key, as can be seen in the bit-rate column 
in Table 1. Alice and Bob reconcile an errorless string us- 
ing the Cascade protocol, which leaks additional information 
to Eve, decreasing her probability of error to — 8%. Privacy 
amplification is performed to reduce Eve's knowledge of the 
final key to less than 1 bit in total. To ensure the overall se- 
curity of our protocol is maintained, we attribute Eve in each 
of the processing stages a level of information that is above 
the maximum theoretical information that she could have ob- 
tained. Figure |5] shows the secret key rate of our QKD proto- 
col as a function of transmission loss. For a lossless quantum 
channel we achieve a final secret key rate of — 25 Mbits/s. For 
transmission losses of 90%, we are still able to generate a final 
secret key at a rate of — 1 kbits/s out of only 17 MHz of our 
broadband spectrum, which represents a major improvement 
over previous protocols. The solid line in Fig.[3]gives the the- 
oretical curve for transmitting information at the Shannon's 
limit. For all transmission losses, the experimental secret key 
rate after post-selection is at this limit. The final secret key 
rate is less than the Shannon's capacity as the information 
reconciliation procedure discloses more error correction infor- 
mation than Shannon's equivocation limit stipulates 11611 . The 
size of the final secret key that can be extracted after privacy 
amplification is calculated using Eve's Renyi entropy (Fig. [5}, 
which is always a lower bound on her Shannon entropy. 

In conclusion, we have implemented an end-to-end coher- 
ent state QKD protocol for channel losses up to 90% by us- 
ing weak sideband modulation techniques and simultaneously 



measuring the amplitude and phase quadratures of the elec- 
tromagnetic field. In our analysis we only consider 17 MHz 
of the sideband frequency spectrum. Extending this analysis 
to a much larger frequency bandwidth will enable orders of 
magnitude increase in the rate of secret key generation. Our 
system is not hampered by the technical difficulties of pro- 
duction and detection of single photon states that constrain 
discrete variable QKD protocols. We show that our protocol 
is secure against a beam-splitting attack, and in our analysis 
we always assume maximal estimates of Eve's information. 
The QKD scheme demonstrated provides a viable platform 
for the development of real-world cryptographic applications 
over local area networks, or city-wide networks. 

We thank W. P. Bowen, T. J. Williams, D. Pulford, 
Ph. Grangier and N. J. Cerf for useful discussions. This re- 
search is supported by the Australian Research Council and 
the Australian Department of Defence. 



[1] N. Gisin, G. Ribordy, W. Tittel, H. Zbinden, Rev. Mod. Phys. 
74, 145 (2002). 

[2] S. L. Braunstein and P. van Loock, Rev. Mod. Phys. 77, 513 
(2005). 

[3] C. H. Bennett, G. Brassard, Proceedings IEEE International 
Conference on Computers, Systems and Signal Proceedings 
(Bangalore) (IEEE, New York, 1984), pp. 175-179. 

[4] T. C. Ralph, Phys. Rev. A, 61, 010303(R) (1999). 

[5] F. Grosshans, P. Grangier, Phys. Rev. Lett., 88, 057902 (2002). 

[6] Ch. Silberhorn, T. C. Ralph, N. Lutkenhaus, G. Leuchs, Phys. 
Rex: Lett., 89, 167901 (2002). 

[7] F. Grosshans et al, Nature, 421, 238 (2003). 

[8] C. Weedbrook et al, Phys. Rev. Lett., 93, 170504 (2004). 

[9] S. Lorenz, N. Korolkova, G. Leuchs, Appl. Phys. B., 79, 273 
(2004). 

[10] M. Hillery, Phys. Rev. A, 61, 022309 (2000); Ch. Silberhorn, 
N. Korolkova, G. Leuchs Phys. Rev. Lett., 88, 167902 (2002). 

[11] F. Grosshans, Phys. Rev. Lett. 94, 020504 (2005). 

[12] M. Navascues, A. Acin Phys. Rev. Lett. 94, 020505 (2005); 
S. Iblisdir, G. Van Assche, N. J. Cerf, Phys. Rev. Lett. 93, 
170502 (2004); D. Gottesman, J. Preskill, Phys. Rev. A 63, 
022309 (2001). 

[13] M. A. Nielsen, I. L. Chuang, in Quantum Computation and 
Quantum Information, (Cambridge University Press, Cam- 
bridge, 2000). 



5 



[14] C. W. Helstrom, Quantum Detection and Estimation Theory, 

(Academic Press, New York, 1976). 
[15] L. B. Levitin, in Quantum Communications and Measurements, 

edited by V.P.Belavkin, O.Hirota, and R.L. Hudson (Plenum 

Press, New York, 1995), pp. 439-448. 
[16] C. E. Shannon, Bell Syst. Tech. J., 27, 623 (1948). 
[17] U. M. Maurer, IEEE Trans.Inf. Theory, 39, 733 (1993). 



[18] G. Brassard, L. Salvail, Advances in Cryptology-Eurocrypt'93, 
(Springer- Verlag, New York, 1993), pp. 411-423. 

[19] C. H. Bennett, G. Brassard, C. Crepeau, U. M. Maurer, IEEE 
Trans.Inf. Theory, 41, 1915 (1995); C. Cachin, U. M. Maurer, 
J. Cryptology, 10, 97 (1997). 



